Technology & Cyber

About

Services

Resources

Contact Us

##Title##

tag-dynamic

Tag-dynamic

If you don&rsquo;t think your company has experienced a cyber attack, then your IT security team is doing a great job. The truth is, it&rsquo;s not a matter of &lsquo;if&rsquo; a company will be attacked, it&rsquo;s &lsquo;when&rsquo;. Cyber security doesn&rsquo;t rest solely on the shoulders of your IT team &ndash; it&rsquo;s everyone&rsquo;s responsibility. We&rsquo;ve put together a glossary of terms to help all employees brush up on their cyber security terminology. The more you know, the more you can do your part to mitigate cyber risks.

25 Cyber security terms not just your IT security team should know

Phishing is a technique where&nbsp;cybercriminals send fake emails, texts or websites that look like legitimate correspondence to manipulate employees into gaining access to corporate systems or information.
Key characteristics include: &bull; Tries to trigger a quick reaction from you &bull; Provides a link to a separate website &bull; Typically asks you to "update", "validate" or "confirm" private information&nbsp; &bull; Often imitates an official sender (e.g. your company or government or financial institution)

Spot a phish, protect your business

Follow these six tips to help you select a safe video conferencing platform and secure your webcam.

Cyber Spies: How to Safely Use Webcams and Video Conferencing

With a rapid increase of telecommuting, follow these tips to help reduce threats.

7 Tips to Protect your Business from the Risks of Remote Employees

Follow these&nbsp;five&nbsp;tips&nbsp;to&nbsp;help&nbsp;strengthen&nbsp;your company&rsquo;s cyber defences, protect&nbsp;your employees from receiving malicious content and toughen your defences with continually educating your employees about security best practices and scams.

5 ways to Bolster your IT Security Strategy with Employee Training

One of the best ways to keep employees and business data protected is by having them connect via Virtual Private Network (VPN). Here are five ways VPNs can keep remote employees secure.

5 Reasons to Offer a VPN to Remote Employees

While businesses are becoming increasingly aware of the dangers of social engineering, it&rsquo;s important to remain ever vigilant because the tactics continue to evolve. Tactics like phishing remain a threat and there&rsquo;s no doubt that the impact can be substantial. That being said, the impact is generally contained to one company. Vendor Email Compromise (VEC) on the other hand is an emerging social engineering tactic that not only compromises one company, but their entire supply chain. These strikes are becoming increasingly more prevalent, as they bring the possibility of an even bigger payout for attackers. According to Armen Najarian, Chief Identity Officer of The Agari Cyber Intelligence Division (ACID) group, &ldquo;on average, a Business Email Compromise (BEC) CEO fraud attack will generally pay out in the $50,000 to $55,000 range, but a successfully executed Vendor Email Compromise (VEC) attack will pay more than double at around $125,000 on average.&rdquo; 1&nbsp; According to Agari, &ldquo;VEC is likely to overtake BEC as the single biggest potential financial fraud during the course of 2020.&rdquo; 2&nbsp; That&rsquo;s why it&rsquo;s so important to watch out for and properly educate employees &ndash; especially those that receive and process invoices.&nbsp; Here&rsquo;s what you need to know to prevent a VEC attack on your business.
<h3>What is Vendor Email Compromise (VEC)?</h3>
A VEC attack aims to take over the email account of a vendor. The attacker issues near-identical vendor invoices or billing documents to the often-larger client companies with new banking information in the hopes of diverting payments to themselves. The destination accounts are often accounts owned by the attacker, used to aggregate funds from multiple targets but, without a paper trail leading back to the attacker.
<h3>How do they do it?</h3>
<ul>
<li>The VEC group sends phishing emails to the vendor's staff that include a malicious link.</li>
<li>Once the vendors click on the link, they're redirected to a phishing login page where vendors are asked to log in using their credentials.</li>
<li>Once the vendors enter their credentials, the attacker uses those credentials to set a forwarding rule to forward all emails received by the vendors to the attacker's email.</li>
<li>The attacker then monitors the inbox for any emails regarding invoices or payments.</li>
<li>If the attacker notices emails that contain invoices or payments, they will duplicate those invoices and send a modified invoice with new banking details pointing to an attacker owned account (often a mule account).</li>
<li>The actual target customer is never phished or directly contacted.</li>
<li>The vendor's customer makes a payment to the attacker's bank account thinking that the email invoice is from the vendor.</li>
</ul>
<h3>What to look for:</h3>
<ul>
<li>Urgent requests to change bank account information or payment instructions.</li>
<li>Updating account or payment information right before the normal payment cycle.</li>
<li>Requests for one-time wire transfers or EFTs to a different bank or account number.</li>
<li>Invoices from possible spoofed or suspicious looking email addresses.</li>
<li>Invoices from representatives at the vendor organization that do not typically send invoices or are not recognized.</li>
</ul>
<h3>Prevention Techniques:</h3>
<ul>
<li>Ask for confirmation of banking information or payment changes through another method:
<ul>
<li>Telephone number published in the original intake form or published on the company's website (instead of using a phone number provided by the potentially compromised email).</li>
<li>An alternate email address from the same domain (@companyxyz.com) but not provided by the compromised email address.</li>
</ul>
</li>
<li>Consider a secondary review of payment information changes by another team member to increase the probability of identifying unusual or suspicious information.</li>
<li>Recommending preventative measures for vendors:
<ul>
<li>Disallow email auto-forwarding rules.</li>
<li>Ensure anti-phishing/suspicious email training is completed.</li>
</ul>
</li>
</ul>
Sources
1Townsend, K. (2019, November 4).&nbsp; <a https:="" www="" securityweek="" com="" vendor-email-compromise-latest-identity-deception-attack="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.securityweek.com/vendor-email-compromise-latest-identity-deception-attack" title="" target="_blank" rel="noopener" aria-invalid="true">Vendor Email Compromise is Latest Identity Deception Attack</a>. Retrieved March 11, 2020 2Townsend, K. (2019, November 4).&nbsp; <a https:="" www="" securityweek="" com="" vendor-email-compromise-latest-identity-deception-attack="" target="" _blank="" rel="" noreferrer="" noopener=""></a><a href="https://www.securityweek.com/vendor-email-compromise-latest-identity-deception-attack" title="" target="_blank" rel="noopener" aria-invalid="true">Vendor Email Compromise is Latest Identity Deception Attack</a>.&nbsp;Retrieved March 11, 2020

Understanding Vendor Email Compromise Attacks

It may be called &ldquo;silent&nbsp;cyber,&rdquo; but the topic is generating a lot of noise in the commercial insurance sector.
<h3>What is silent cyber?</h3>
Silent or &ldquo;non-affirmative&rdquo; cyber refers to potential cyber-related insurance losses arising from insurance policies that weren&rsquo;t specifically designed to cover cyber risks. The policies don&rsquo;t explicitly include or exclude cyber risk, which creates ambiguity and can leave coverage open to interpretation. A standalone cyber insurance policy, on the other hand, clearly outlines what is covered (aka affirmative coverage), such as privacy, business interruption and extortion coverage, to name a few.
<h3>Why is silent cyber a rising concern?</h3>
While silent cyber isn&rsquo;t a new concept, it&rsquo;s getting more attention with the rise of cybercrime and the cost of attacks. Simply put, businesses can&rsquo;t afford to have inadequate or ambiguous cyber protection.&nbsp; According to the 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute, the average cost of cybercrime to a Canadian company was $12.1 million in 2018. 1&nbsp;Globally, six in seven companies (85%) experienced phishing and social engineering cyber attacks in 2018, and three-quarters (76%) suffered web-based attacks. Cybersecurity Ventures projects that the global cost of cybercrime will hit $6 trillion by 2021, up from $3 trillion in 2015. 2 Furthermore, PwC&rsquo;s latest Global Economic Crime and Fraud Survey found that cybercrime features in the top three most disruptive crimes experienced in almost all industries reported in the survey. 3 As the frequency, scale and cost of attacks continue to rise, so too does the concern around silent cyber. It&rsquo;s more important than ever that policyholders understand their coverage so they&rsquo;re not stuck in a position of believing they have adequate coverage when in reality, they may not. A stand-alone cyber policy helps ensure that they reduce possible gaps in protection.
<h3>Are there regulations around silent cyber?</h3>
The U.K. was the first major market to take a tough stand on silent cyber. Last year, the Prudential Regulation Authority (part of the Bank of England) called on Lloyd&rsquo;s of London and the wider insurance sector to ensure the management of affirmative and non-affirmative cyber risk exposures. Following that, Lloyd&rsquo;s announced that it&rsquo;s mandating that all non-affirmative policies provide clarity regarding cyber coverage by either excluding or providing affirmative coverage.&nbsp;&nbsp; Similarly, on the policyholder side, global ratings agency A.M. Best announced it &ldquo;expects companies to be proactive and forthcoming with their own evaluation and measurement of the exposure and accumulation of their cyber liability exposure.&rdquo; 4 While regulations in Canada have yet to be tabled, insurers are reviewing how coverages can be placed through all policies&euro;&rdquo;not just dedicated cyber policies.&nbsp;
<h3>What can an insurance company do to prevent potential gaps in coverage?</h3>
Both brokers and commercial property underwriters need to become more aware of the issues relating to cyber events. That starts with detailed risk assessments to clearly understand the specific cyber vulnerabilities of an organization. For example, an industrial plant might be aware of its risk of a boiler explosion, but this type of event could also happen in a cyber-attack. A plant could be targeted by a cyber virus that disables the critical safety control systems relating to a boiler&rsquo;s operational procedure, exposing the plant to a possible explosion. This could result in a major disruption in the plant&rsquo;s daily operations &euro;&ldquo; not to mention a serious public safety risk. Education is a key factor for all brokers and underwriters, whether they specialize in property liability, or other risks ranging from D&amp;O, crime, environmental and other commercial divisions. As cyber risks continue to rise, so too does the need for explicit coverage. Stand-alone cyber policies help reduce possible gaps in protection. If you&rsquo;re unsure as to whether your operations are fully covered, contact your broker today.
Sources
1 <a rel="noreferrer noopener" href="https://www.accenture.com/_acnmedia/pdf-96/accenture-2019-cost-of-cybercrime-study-final.pdf" target="_blank" _blank="">The Ninth Annual Cost of Cybercrime </a>Study 2019 by Accenture and Ponemon Institute 22020 <a href="https://www.herjavecgroup.com/the-2019-official-annual-cybercrime-report/">Official Annual Cybercrime Report</a> by Cybersecurity Ventures, sponsored by Herjavec Group 3 <a href="https://www.pwc.com/gx/en/services/forensics/economic-crime-survey.html">PWC&rsquo;sGlobal Economic Crime and Fraud Survey 2020</a> 4Moorcraft, B. (2018, November 26). <a rel="noreferrer noopener" href="https://www.insurancebusinessmag.com/ca/guides/what-is-silent-cyber-risk-117152.aspx" target="_blank" _blank="">What is silent cyber risk? </a>Retrieved May 19, 2020
"

The Rise and Risks of Silent Cyber

Despite the rise of automation and artificial intelligence technologies, the vast majority of business that gets conducted relies on some sort of human interaction or connection. Employees are an organization&rsquo;s greatest asset, but also remain every organization&rsquo;s weakest link when it comes to defending against a cyber breach. You can implement the latest firewall technology and employ a genius Chief Information Officer, but if all staff members aren&rsquo;t aware of the types of scams that cyber criminals are trying to pull, then chances are your organization could fall victim to a social engineering attack.
<h3>What is social engineering?</h3>
Simply put, social engineering is a form of psychological manipulation that targets the user rather than the computer itself &ndash; and it&rsquo;s proving to be very effective for cybercriminals. It plays on our universal human traits of fear, trust and conformity to get access to information, all without hacking into a system or cracking a code or password.

<blockquote>
Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature.
</blockquote>
<h3>The impact on your business</h3>
If organizations don&rsquo;t take measures to educate and train their employees on social engineering tactics, it&rsquo;s more likely that they&rsquo;ll fall for scams, get hacked, experience a breach and become the victim of fraudulent wire transfers. Any of these events can be incredibly costly and could impact the company&rsquo;s reputation. And this can be repeated multiple times if the bad guys find a &lsquo;good victim&rsquo;. In addition to the monetary impact, being scammed doesn&rsquo;t feel good and can take an emotional toll on your employees.
<h3>Phishing tactics</h3>
Phishing is a technique where cybercriminals send fake emails, texts or websites that look like legitimate correspondence to manipulate employees into gaining access to corporate systems or information. It uses social engineering tactics by deceptively preying on employees&rsquo; emotions and relying on them to mistakenly hand over access to target information.
A phishing breach usually occurs when a hacker gets the structure of an organization&rsquo;s email addresses and then sources a list of names of company employees, usually from LinkedIn or the company&rsquo;s own website.
Similarly, a cybercriminal could get the log in details to a company executive&rsquo;s email address and send out emails to other employees directly from that account. They could then either request sensitive information or ask them to send wire transfers on behalf of the company. In many cases, the employee receiving that email will think the request is legitimate and provide the sensitive information or transfer the funds.
Another form of phishing sees hackers send out emails &ndash; again appearing to be from a legitimate email address &ndash; containing a link or attachment.
That link can do a couple of different things: it can send them to a web page with a form which asks them to provide personal information, it can include spyware to gather information on the company (and its employees and clients), or it can include a ransomware file attachment which activates when downloaded. That file will encrypt the files on the user&rsquo;s computer and only unencrypt them when a ransom is paid to the criminal&rsquo;s bank account.
<h3>Tips to protect your business</h3>
Social engineering is something that can be mitigated if employees are well educated. Your first line of defense might be to invest in antivirus software and firewall (software and physical versions) with intrusion detection capabilities &ndash; and that&rsquo;s a great start. But that won&rsquo;t account for human weaknesses, like a lack of attention to detail or an all too trusting nature. That&rsquo;s why it&rsquo;s so important to educate employees on social engineering and phishing, and the specific tactics they should look out for. This can help foster a culture in which employees are alert and cautious with information whether they&rsquo;re online or in-person.
Encourage employees to follow the steps below to reduce the chances of social engineering impacting your organization:
<ul>
<li>Avoid opening emails from unknown email addresses</li>
<li>Create better, stronger passwords &ndash; and change them regularly</li>
<li>Avoid less than reputable internet sites, web and smartphone applications</li>
<li>Cut down on the amount of biographically accurate information you divulge online (e.g. listing your birthdate on social media)</li>
<li>Only use trusted sites when online</li>
<li>Don&rsquo;t click on links you&rsquo;re sent. Instead, open the webpage on your own by typing in the URL yourself to make sure you&rsquo;re going to a legitimate site and not a phishing scam site</li>
<li>Log out of Facebook and other social media accounts when you&rsquo;re not using them and before you close your browser window</li>
<li>Don&rsquo;t choose &ldquo;save my password&rdquo; or &ldquo;remember me&rdquo; when logging onto any type of account, as these credentials can be stolen by hackers</li>
<li>Follow the company&rsquo;s &ldquo;new vendor/account change&rdquo; protocol to verify clients before sending wire transfers above a certain predetermined threshold. This could involve requiring employees to call vendors (using the phone number in your files, not the one in the email) before making the transfer.</li>
</ul>

Social engineering: your business is at risk from human blunders

Cyber attacks are a growing concern for organizations across all sectors&mdash;and with good reason. Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute. 1&nbsp;As the number of attacks increases, so too does the cost: CyberSecurity Ventures predicts that global losses related to cyber attacks will reach US$6 trillion by 2021, up from US$3 trillion in 2015.&nbsp; 2 A new report from Aon, &ldquo;Prepare for the expected: Safeguarding value in the era of cyber risk,&rdquo; 3&nbsp;notes that business face financial loss in the form of immediate crisis expenses, regulatory fines and lost revenue from disruption to the business. There&rsquo;s also reputational risk, as an attack can erode a company&rsquo;s market value, destroy brand loyalty and limit a company&rsquo;s digital transformation, notes Aon. Businesses are wisely investing in cyber security&mdash;CyberSecurity Ventures predicts more than US$1 trillion will be spent from 2017 to 2021&mdash;but no measures are 100% effective. That&rsquo;s why it&rsquo;s also critical to have a cyber resilience plan in place, which covers how your organization withstands, responds to, and recovers from a cyber attack or data breach. While cyber resilience plans will look different at every organization, one commonality is the importance of testing those plans. A stress test allows organizations to see how quickly and effectively they react and respond to any given cyber risk. As Deloitte notes in the report, &ldquo;Five essential steps to improve cyber security,&rdquo; 4&nbsp;most organizations have a security management process in place, but few have tested it.
<figure class="wp-block-pullquote">
<blockquote>
Globally, the average number of security breaches experienced by a company in the last year grew by 11% from 130 to 145, according to 2019 &ldquo;Cost of Cybercrime&rdquo; study by Accenture and the Ponemon Institute. 1 
</blockquote>
</figure>
The report outlines key questions organizations should ask, such as &ldquo;Who should be contacted during and after an incident?&rdquo; and how quickly can you contain a security breach and restore your organization to normal operation?&rdquo; &ldquo;But answering the questions is just part of the equation,&rdquo; Deloitte states. &ldquo;Testing your answers is critical.&rdquo;
<h3>Here are four best practices for testing your cyber resilience plan:</h3>
<ul>
<li>Get everyone on the same page:&nbsp;As with any large undertaking, C-suite support is the first&mdash;and most essential&mdash;step in creating and testing a cyber resilience plan. As one cyber-security expert notes, without C-suite support, it&rsquo;s impossible for cyber-security leaders to effectively plan for and defend against threats. 5&nbsp;And since cyber security affects every employee, everyone in the organization needs to be aware of the plan and understand their roles and responsibilities.</li>
<li>Conduct a vulnerability scan:&nbsp;In the computing world, a vulnerability is a weakness in a device or system that can be exploited by cyber attackers. A vulnerability scan (or assessment) allows businesses to identify which parts of their system are the weakest and most likely to be targeted, and therefore the most relevant to the cyber resilience plan. 6</li>
<li>Carry out cyber simulations:&nbsp;As Deloitte notes, cyber simulations are interactive techniques that immerse participants in a simulated attack scenario to help organizations evaluate their response and preparedness. Some specific attacks organizations may want to test for are phishing emails&mdash;fraudulent emails designed to get people to unwittingly share passwords or financial information, or malicious attachments&mdash;documents that appear to be legitimate, but are actually a virus or malware.</li>
<li>Review and make improvements to your plan:&nbsp;&ldquo;There&rsquo;s absolutely no point running simulated attacks if they&rsquo;ll play no role in optimizing the incident response processes,&rdquo; says another cyber-security expert. 7&nbsp;Determine what worked well and what didn&rsquo;t in your response plan. Identify areas for improvement and adjust the necessary processes.</li>
</ul>
If you&rsquo;ve followed these steps but feel like you still need some support or guidance, your insurer may be able to help. The possibility of a cyber attack doesn&rsquo;t have to be overwhelming when you&rsquo;ve stress tested your plan and know it stands up.
Sources
1&nbsp;Research Report:&nbsp; <a href="https://www.accenture.com/ca-en/insights/security/cost-cybercrime-study" aria-invalid="true">"Ninth annual cost of cybercrime study."&nbsp;</a>Accenture, March 6, 2019 2&nbsp; <a href="https://cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021">"Global Cybercrime Damages Predicted to Reach $6 Trillion Annually By 2021".&nbsp;</a>Cybercrime Magazine, December 7, 2018 3&nbsp;Media Release&nbsp; <a href="https://aon.mediaroom.com/csuitecyberreport">"Aon report shares C-suite insights as losses from cyber attacks set to reach all-time highs"</a>,&nbsp;accessed December 4th, 2019 4&nbsp; <a href="https://www2.deloitte.com/content/dam/Deloitte/ca/Documents/risk/ca-en-risk-cyber-5-steps.pdf">"Five essential steps to improve cybersecurity",</a>&nbsp;Deloitte, accessed December 4th, 2019 5&nbsp;Burley, Ron " <a href="https://www.cpomagazine.com/cyber-security/how-cybersecurity-leaders-can-best-navigate-the-c-suite/" aria-invalid="true">How Cybersecurity Leaders Can Best Navigate the C-Suite"</a>&nbsp;CPO Magazine, September 13, 2019 6&nbsp;" <a href="https://blog.rsisecurity.com/best-practices-for-testing-your-cyber-incident-response-plan">Best Practices for testing you Cyber Incident Response Plan"</a>&nbsp;RSI Security, February 8, 2019 7&nbsp;Reichenberg, Nimmy " <a href="https://www.siemplify.co/blog/testing-incident-response-processes/" aria-invalid="true">Putting Your Incident Response Processes to the Test"</a>&nbsp;Siemplify, July 8, 2018

How to stress test your business for cyber resiliency

Email encryption is the process of encoding your sensitive or private data so that it&rsquo;s scrambled or inaccessible to unauthorized users. Encryption helps ensure confidentiality, protect against unwanted access to your email account, and prevent the interception of sensitive or personal information. It&rsquo;s an important measure to put in place when communicating confidential information to help prevent a data breach. Afterall, if a hacker can&rsquo;t read contents of the email, they can&rsquo;t harm you with it.
<h3>What type of information should you encrypt?</h3>
Private, confidential information that should be encrypted may include bank and credit card details, financial statements, personal client information, passwords, security documents, and tax records &ndash; just to name a few. Unauthorized disclosure of this information could lead to financial loss or identity theft, so special care and preventive measures must be taken to protect it.
<h3>How does it work? 1 </h3>
Encrypted data is scrambled so that it&rsquo;s illegible to anyone who doesn&rsquo;t have the decryption key or password to &lsquo;decode&rsquo; and access the information. &lsquo;Keys&rsquo; are the digital codes that allow you to encrypt and decrypt messages. The information is coded and decoded as follows:
<ul>
<li>A public key is a digital code used to encrypt the email. The sender uses the recipient&rsquo;s public key to scramble the email message. This key is stored on a key server that&rsquo;s accessible to anyone. You cannot send an encrypted email to someone without access to their public key.&nbsp;</li>
<li>A private key is a private digital code that the recipient uses to decode the email. It&rsquo;s stored on their private computer.</li>
</ul>
There are two main types of email encryption methods: S/MIME (Secure/Multipurpose Internet Mail Extensions) and PGP/MIME (Pretty Good Privacy/Multipurpose Internet Mail Extensions). Here&rsquo;s the difference:
<ul>
<li>S/MIME:
<ul>
<li>relies on a centralized authority to pick the encryption algorithm</li>
<li>built into large web-based email companies such as Gmail and Outlook</li>
<li>key code is generated for you</li>
</ul>
</li>
<li>PGP/MIME:
<ul>
<li>relies on a decentralized authority to pick the encryption algorithm</li>
<li>offers more flexibility and control over how you want your emails to be encrypted</li>
<li>requires a third-party encryption tool</li>
</ul>
</li>
</ul>
In order for the recipient to decrypt an email encrypted by the sender, both parties must use the same encryption method.
<h3>How to encrypt your emails</h3>
Before you send an encrypted email, be sure to let the recipient know in advance that you&rsquo;re initiating an encrypted email conversation. And once all sensitive information has been shared, it&rsquo;s important to close the confidential encrypted email thread by starting a new email conversation. This way future messages won&rsquo;t be encrypted automatically, and you won&rsquo;t inconvenience the recipient with the additional step of requesting a passcode.&nbsp; For details on how to encrypt your emails, refer to these resources for helpful instructions:
<ul>
<li><a href="https://support.microsoft.com/en-us/office/encrypt-email-messages-373339cb-bf1a-4509-b296-802a39d801dc" target="_blank" rel="noreferrer noopener">Outlook</a></li>
<li><a href="https://support.google.com/mail/answer/6330403?hl=en" target="_blank" rel="noreferrer noopener">Gmail</a></li>
<li><a href="https://support.apple.com/en-ca/HT202345" target="_blank" rel="noreferrer noopener">iOS</a></li>
</ul>
<h3>Other cyber security considerations</h3>
Email encryption is a great way to help protect the sensitive data you&rsquo;re sending back and forth, but it&rsquo;s just one tactic within a company&rsquo;s overall cyber security strategy. In addition, it&rsquo;s important to carry out robust cyber exposure analysis and work with your broker to implement proactive risk management solutions.&nbsp;
Source
1January 2, 2019. Panda Security Media Center. <a rel="noreferrer noopener" href="https://www.pandasecurity.com/en/mediacenter/panda-security/how-to-encrypt-email/" target="_blank">&nbsp;&ldquo;How to Encrypt Email (Gmail, Outlook, iOS, Yahoo, Android, AOL)&rdquo;</a>. Retrieved October 26, 2020

How to encrypt email

A data breach is a business emergency that has to be managed quickly and effectively to mitigate losses and stay on the right side of compliance. When such an event happens, many organizations call in a data breach coach: the &ldquo;first responder&rdquo; who leads the response and recovery. Typically, a data breach coach is a lawyer who specializes in cyber security and privacy law. Acting as a project manager, they guide an organization on the best course of action, with help from a team they assemble from a variety of disciplines. The team can include experts from IT, forensics, legal, regulatory and communications, all of whom may be needed to help manage the breach. 1 Why work with a data breach coach? As in many other crisis-management situations, your in-house staff may not have the expertise to handle a data breach, or you may want to keep your key staff focused on their regular responsibilities. Having a legal expert take the lead is beneficial, as they understand laws regarding notification requirements and have experience working with regulators on issues like fines and penalties. One legal expert also noted that as lawyers, data breach coaches are able to guard your information with solicitor-client privilege, which can add an extra layer of protection and security to your communications. 2 There are three key areas that data breach coaches manage:
<ol>
<li>Breach Investigation: A data breach coach can help you hire a computer forensics company to investigate the cause and scope of breach. Forensic teams work to identify the type of hack, approaches used, the source and timeline, and determine how best to recover compromised data. 3 They also preserve all the necessary evidence and can work with the data breach coach to identify potential legal and compliance issues. 4</li>
<li>Notification Requirements:&nbsp;A data breach coach will analyze the facts uncovered by forensics to determine what steps to take in a legal context and help your business remain compliant. Legal obligations may include providing notice of the breach to affected individuals and regulators, depending on what information was compromised. For example, in Canada, a breach involving &ldquo;real significant harm&rdquo; to individuals needs to be reported to the Office of the Privacy Commissioner of Canada.&rdquo; Real significant harm is determined based on the sensitivity of the information involved in the breach and probability for misuse. 5&nbsp;</li>
<li>Crisis Communications:&nbsp;A data breach coach can secure crisis communications professionals to ensure any communications regarding a data breach are carefully planned and managed. This can reduce risks such as reputational harm to your business.&nbsp; 6&nbsp;The team can determine how those affected by the breach should be alerted, what statements to make to the public and the media, and how to communicate with authorities. They can also provide contact information and handle inquiries from customers and the media.&nbsp; 7,8</li>
</ol>
In the event of a data breach, it&rsquo;s important to respond quickly and correctly. If your organization doesn&rsquo;t have the internal resources to handle legal and compliance issues, or have expertise in crisis communications, having a data breach coach take the lead is a smart move. They are an invaluable source of information and expertise, and can help take the load off your shoulders in a time of crisis.
Sources: 1 <a rel="noreferrer noopener" href="https://www.siskinds.com/data-breach-frequently-asked-questions/" target="_blank">&ldquo;Data Breach: Frequently Asked Questions,&rdquo;</a> Siskinds, May 2020 2,6 <a rel="noreferrer noopener" href="https://www.forbes.com/sites/forbestechcouncil/2019/07/29/why-your-company-should-secure-a-breach-coach/?sh=244dc8006b76" target="_blank">&ldquo;Why Your Company Should Secure A Data Breach Coach,&rdquo;</a> Forbes, July 29, 2019 3,4 <a rel="noreferrer noopener" href="https://securecyberdefense.com/digital-forensics-identifying-the-who-what-when-and-how-of-cyberattacks-2/" target="_blank" aria-invalid="true">&ldquo;Digital Forensics: Identifying the Who, What, When and How of Cyber Attacks,&rdquo;</a> Secure Cyber Defense 5 &ldquo; <a rel="noreferrer noopener" href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/#_Part_6" target="_blank">What you need to know about mandatory reporting of breaches of security safeguards,&rdquo; </a>Office of the Privacy Commissioner of Canada, Oct. 2018 7 <a rel="noreferrer noopener" href="https://www.pushkinpr.com/blog/crisis-communications-plan-data-breaches/" target="_blank">&ldquo;A Crisis Communications Plan for Data Breaches,&rdquo;</a> Pushkin PR 8 <a rel="noreferrer noopener" href="https://medium.com/@crisisPR/why-your-company-needs-a-data-breach-communications-plan-6dd3488bb3e3" target="_blank">&ldquo;Why Your Company Needs a Data Breach Communications Plan,&rdquo; </a>Medium, March 9, 2020

Do you need a data breach coach?

In the event of a cyber-attack, properly prepared businesses take immediate action, whether it&rsquo;s putting their IT team on the case, or calling in experts like a cyber breach coach. While having a response plan in place is vital to mitigate risks such as business interruption, regulatory fines, or legal costs, there&rsquo;s another critical side to the cyber security coin: prevention.&nbsp; With shifts in our work lives and technology usage, new cyber risks have emerged. For example, a recent study found that 82% of IT leaders believe their company is at greater risk of phishing attacks when employees are working remotely.&nbsp; 1&nbsp;In addition, with many employees using personal devices for work, IT professionals are worried about security risks such as downloading unsafe apps, malware infections and software updates. 2 In this changing landscape, it&rsquo;s crucial for businesses of all sizes to take a proactive approach to cyber protection. Having the right safeguards in place can help prevent a range of cyber losses &mdash; from data breaches and theft of intellectual property, to financial losses stemming from social engineering, ransomware, and other attacks.&nbsp; Here&rsquo;s a look at key measures that can help protect your business from cyber losses: Employee training programs and simulations: Human error&mdash;meaning an unintentional action or lack of action that allows a cyber incident to take place&mdash;is behind nearly all successful data and security breaches. 3&nbsp; That&rsquo;s why employee training and education is so vital: it can help you avoid cyber incidents and strengthen your organization&rsquo;s overall cyber security culture.&nbsp; 4&nbsp; The Canadian Centre for Cyber Security recommends organizations consider education and training topics such as: creating unique passphrases and complex passwords for all accounts; using the internet and social media safely in the workplace; using approved software and mobile applications; and identifying malicious emails.&nbsp; 5 You can then put that training to the test with attack simulations. These allow you to see how employees would respond to different types of attacks, in real-world situations. For example, a phishing test sends employees a fake malicious email and/or a fake website to see if they&rsquo;ll open attachments and/or click on the links, or if they report the suspicious email. 6 Vulnerability scans and penetration tests: On the IT side, you can test your organization&rsquo;s defenses with vulnerability scans and penetration tests. Vulnerability scanners are automated tools that allow organizations to check if their networks, systems and applications have security weaknesses that could expose them to attacks.&nbsp; 7 Common vulnerabilities include substandard backup and recovery; weak authentication management; and poor network monitoring, among others.&nbsp; 8 Penetration testing, also known as a &ldquo;pen test&rdquo; or &ldquo;ethical hacking,&rdquo; goes beyond vulnerability scanning. Using a mix of automated tools and manual techniques, a penetration test identifies vulnerabilities and then attempts to exploit those vulnerabilities.&nbsp; 9 To illustrate the difference between vulnerability scans and penetration testing, a cyber security firm uses this analogy: A vulnerability is like walking up to a door, checking to see if it&rsquo;s unlocked, and stopping there. A penetration test not only sees if the door is unlocked, but also opens the door and walks right in. 10 Cyber security consultants:&nbsp;While cyber breach coaches help organizations deal with the aftermath of a cyber-attack, cyber security consultants are often hired to build the right defenses. These experts provide a range of services, including IT systems auditing, system monitoring, building firewalls and helping organizations stay compliant with government regulations.&nbsp; Cyber security consultants are typically involved with every employee contact point for company data, including devices, applications, data storage and internal networks. Knowing how staff interact digitally allows these experts to identify potential weaknesses and plan for how to protect against them. 11 As risks evolve, a proactive approach to cyber protection is crucial. When planning your defense strategy, it&rsquo;s important to consider insurance coverage that&rsquo;s specifically designed to address the unique and emerging risks to your business.&nbsp;
Sources
1,2&nbsp;Tessian,&nbsp; <a href="https://www.tessian.com/blog/hybrid-working-cybersecurity-risks/" target="_blank" rel="noreferrer noopener">&ldquo;How hybrid-remote working with affect cybersecurity,&rdquo;</a>&nbsp;Sept. 2020 3&nbsp;Hacker News, &ldquo; <a href="https://thehackernews.com/2021/02/why-human-error-is-1-cyber-security.html" target="_blank" rel="noreferrer noopener">Why human error is #1 cyber security threat to businesses in 2021</a>,&rdquo; Feb. 4 2021 4,5&nbsp;Canadian Centre for Cyber Security,&nbsp; <a href="https://cyber.gc.ca/en/provide-employee-awareness-training" target="_blank" rel="noreferrer noopener">&ldquo;Provide employee awareness training,</a>&rdquo; Feb. 16 2021 6&nbsp;Dashlane,&nbsp; <a href="https://blog.dashlane.com/phishing-test/" target="_blank" rel="noreferrer noopener">How to run an effective phishing test at work</a>, March 7 2020 7, 9&nbsp;Rhino Security Labs, &ldquo; <a href="https://rhinosecuritylabs.com/penetration-testing/need-vulnerability-scan-penetration-test/" target="_blank" rel="noreferrer noopener">Do I need a vulnerability scan or penetration test?</a>&rdquo; 8&nbsp;Logsign, &ldquo; <a href="https://www.logsign.com/blog/what-are-the-types-of-cyber-security-vulnerabilities/" target="_blank" rel="noreferrer noopener">What are the types of cyber security vulnerabilities</a>?&rdquo; 10&nbsp;Control Scan,&nbsp; <a href="https://www.controlscan.com/penetration-tests-vulnerability-scans-different/" target="_blank" rel="noreferrer noopener">&ldquo;Penetration tests vs. vulnerability scans: What&rsquo;s the difference?&rdquo;</a> 11&nbsp;EC-MSP, <a href="https://www.ecmsp.co.uk/it-blog/cybersecurity-consultant-for-business" target="_blank" rel="noreferrer noopener">&nbsp;&ldquo;What can a cyber security company do for your business?&rdquo;</a>

Cyber loss prevention: How to mitigate cyber risks to your business

Having a strong online presence is a necessity for any modern business. No matter what size you are or what industry you&rsquo;re in, having the capability to communicate with customers and carry out transactions online is now customers&rsquo; standard expectation. While most businesses are now savvy to the threats posed by a cyber breach or hack, many may not be aware of the new European privacy regulations introduced in May 2018 that are creating a whole new set of risks for companies that do business in the EU, either physically, or online.
<h3>What is the General Data Protection Regulation?</h3>
The General Data Protection Regulation (GDPR) is a set of data protection rules for all companies that either (a) have an "establishment" in the European Union (EU) and "process" "personal data" in the context of the activities of that establishment, or (b) have no establishment in the EU but they process the personal data of individuals that are in the EU and such processing relates to (1) offering goods or services to an individual in the EU or (2) monitoring the behaviour of individuals, where that behaviour occurs in the EU (all words and phrases in quotations are defined in the GDPR). The rules aim to give consumers more control over their personal data, reshape the way organizations approach data privacy and create a more level playing field for businesses. The GDPR has extra-jurisdictional effect and applies regardless of where a company is physically located. If your activities fall within (a) or (b) in the paragraph above, the GDPR applies to your company. In today&rsquo;s connected marketplace, GDPR has a very wide reach. GDPR requirements are, in many respects, more stringent and comprehensive than similar North American regulations, including the Personal Information Protection and Electronic Documents Act (Canada). The definition of personal data in the GDPR is broad, and the requirements around how to collect, use and disclose personal data in a compliant manner are, in general, more restrictive. For example, under the GDPR a notification regarding most personal data breaches must be sent to the appropriate supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. Further, in many cases, breach notifications must also be sent to affected individuals without undue delay.
<h3>What are the consequences of non-compliance?</h3>
Companies that fail to comply with the GDPR could face significant financial penalties of up to &euro;20 million or 4% of annual global turnover (whichever is greater) for the most serious infringements, such as violating the Privacy by Design concepts or having insufficient customer consent to process personal data. Less serious breaches of the GDPR, including not having records in order and not notifying the supervising authority and data subject about a breach, could lead to a fine of up to &acirc;&sbquo;&not;10 million or up to 2% of annual worldwide turnover (whichever is greater).
<figure class="wp-block-pullquote">
<blockquote>
Companies that fail to comply with the GDPR could face significant financial penalties, the insurability of which remains a bit of a grey area in most jurisdictions. Although a robust cyber insurance policy may cover a company&rsquo;s exposure to privacy breaches under GDPR, PIPEDA and other privacy legislation, criminal penalties are almost never insurable.
</blockquote>
</figure>
<h3>Can insurance provide protection for GDPR fines / penalties?</h3>
Companies that fail to comply with the GDPR could face significant financial penalties, the insurability of which remains a bit of a grey area in most jurisdictions. Although a robust cyber insurance policy may cover a company&rsquo;s exposure to privacy breaches under GDPR, PIPEDA and other privacy legislation, criminal penalties are almost never insurable. Getting a good understanding of your own GDPR related risks is an important first step. Reducing your risk of being fined can be achieved through GDPR compliance.
<h3>If GDPR applies to your company, here are some things to consider</h3>
What personal data are we collecting and where are we storing it?&nbsp;The first step for any company is to understand exactly what personal data it collects and uses, and where it physically stores that personal data, so that it can then develop a GDPR compliance program. Why are we collecting the personal data? &nbsp;Under GDPR, all companies are required to be able to explain how the personal data they collect will be used. Companies also need to be able to send that information to the individual if requested to do so. Do we have adequate consent to collect, use and disclose personal data?&nbsp; GDPR contains strict consent requirements regarding the collection, use and disclosure of any personal data. Companies should ensure that they&lsquo;re compliant with such consent requirements. What cyber risks do we face? &nbsp;&shy;&shy;In addition to the myriad of other consequences that will arise from a data breach, the GDPR contains strict notification requirements with respect to data breaches. This is just one more reason to proactively analyze your cyber weak spots and to take steps to mitigate any risks. What do we do if the worst case scenario does happen?&nbsp; Having a data breach response strategy in place is essential. Make sure your key team members know exactly what to do and who to call as soon as you&rsquo;re aware of the breach. Every minute counts. Compliance is crucial but can be challenging in the murky and often complex world of online business. Being insured adds another, much-needed, layer of security against data breaches, but as we&rsquo;ve noted above, privacy regulations are adding a whole new set of risk factors. So, when it comes to speaking to your insurance broker about renewing your cyber insurance policy, you may want to add &lsquo;GDPR risks&rsquo; to your list of questions.

Collecting personal data from EU residents

When a data breach happens, businesses have a lot to lose. IBM&rsquo;s global Cost of a Data Breach report found that in 2020, companies spent an average of US$3.86 million per breach. The costs include time and effort dealing with the breach, lost revenue due to system downtime, reputation losses, regulatory fines, and legal costs 1.&nbsp; While many companies work hard to ensure their data security is tight, cyber criminals are notorious for being one step ahead.&nbsp;That means it&rsquo;s vital to be prepared for &ldquo;when&rdquo; a data breach happens, not &ldquo;if.&rdquo; To manage data breaches, battle-ready businesses will want to put together a dedicated response team and implement their own plan of attack. Here are five steps to include in the plan:&nbsp;
<h3>Identify how the breach happened and what was leaked.</h3>
First, you need to determine how the attack took place and what data was affected, which can be done using root-cause analysis and forensics 2. Common causes of data breaches include stolen or weak passwords, application vulnerabilities, malware, employee error, and malicious internal acts. By identifying the root cause of the breach and investigating what was leaked, you&rsquo;ll be able to carry out the next steps more effectively 3,4.
<h3>Contain the breach.</h3>
Take steps to contain the breach in as short a time as possible to minimize further damage and risk. An effective course of action is: stopping the unauthorized practice; shutting the system down that was breached; changing passwords immediately; limiting access of individuals suspected of causing the breach; recovering the records; and correcting weaknesses in physical or electronic security 5,6.
<h3>Notify those affected.</h3>
Notify your customers, business partners, vendors, or other parties whose data was affected by the breach. Include the date of the breach; details on what was compromised; and what action, if any, the recipient needs to take 7. Not only do you need to notify individuals of any breach of the security of safeguards involving their personal information, but if the breach is believed to be of &ldquo;significant harm&rdquo;, your organization must also report the breach to the Privacy Commissioner of Canada 8. The Personal Information Protection and Electronic Documents Act (PIPEDA) defines &ldquo;significant harm&rdquo; to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property 9. Notification to impacted individuals and the Privacy Commissioner should take place as soon as possible when the organization determines a breach has occurred.
<h3>Conduct a security audit.</h3>
Managing a data breach doesn&rsquo;t stop once you&rsquo;ve patched things up. A smart next step is to conduct a data-security audit, which allows you to identify threats and vulnerabilities in your company&rsquo;s IT infrastructure and security systems. The steps in an audit generally include: establishing the scope of the audit; creating a master list of all the assets that require protection; defining threats to your data; assessing the risk of each threat; and creating a list of security measures you need to implement 9,12.
<h3>Prepare for future attacks.</h3>
If your company is attacked once, there&rsquo;s a strong possibility it will happen again, as cyber criminals are enticed to try again if they&rsquo;ve already succeeded 13.&nbsp; The vulnerabilities uncovered in your security audit will help you put the right data-security systems and procedures in place, whether it&rsquo;s performing better data backups, conducting cyber-security awareness training, or acquiring more appropriate security technology 14.&nbsp; As you firm up your data-security measures, consider your insurance coverage as a critical component in your plan. Some insurers even offer breach preparation and crisis management services. Contact your broker and ensure you&rsquo;re properly covered in the event of a data breach or other cyber-attack.&nbsp;
Sources
1 <a href="https://www.capita.com/sites/g/files/nginej146/files/2020-08/Ponemon-Global-Cost-of-Data-Breach-Study-2020.pdf" target="_blank" rel="noreferrer noopener">&ldquo;Cost of a Data Breach Report 2020,&rdquo;</a>&nbsp;IBM Security and Ponemon Institute, July 2020 2,3&nbsp;&ldquo; <a href="https://digitalguardian.com/blog/data-breach-experts-share-most-important-next-step-you-should-take-after-data-breach-2014-2015" target="_blank" rel="noreferrer noopener">Data breach experts share the most important next step you should take after a data breach in 2019 &amp; beyond,&rdquo;</a>&nbsp;Digital Guardian, Aug. 11, 2020 4 <a href="https://www.avertium.com/digging-in-why-root-cause-analysis-is-crucial-in-ir/" target="_blank" rel="noreferrer noopener">&ldquo;Digging in: Why root cause analysis is crucial in IR,&rdquo; Avertium,&rdquo;</a>&nbsp;July 17, 2020 5 <a href="https://techaeris.com/2020/12/15/data-breaches-why-and-how-to-handle-the-attack/" target="_blank" rel="noreferrer noopener">&ldquo;Data breaches: Why and how to handle the attack,&rdquo;&nbsp;</a>TechAeris, Dec. 15, 2020 6&nbsp;&ldquo; <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/c-t_201809_pb/" target="_blank" rel="noreferrer noopener">Preventing and responding to a privacy breach,&rdquo;</a>&nbsp;Office of the Privacy Commissioner of Canada, Sept. 2018&nbsp;&nbsp; 7 <a href="https://securitytrails.com/blog/top-5-ways-handle-data-breach" target="_blank" rel="noreferrer noopener">&ldquo;Top 5 ways to handle a data breach,&rdquo;</a>&nbsp;SecurityTrails, Nov. 27, 2018 8,9&nbsp; Office of the Privacy Commissioner of Canada. (2018, October 29).&nbsp; <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/" target="_blank" rel="noreferrer noopener">What you need to know about mandatory reporting of breaches of security safeguards</a>. Retrieved February 05, 2021, 10&nbsp; <a href="https://digitalguardian.com/blog/data-breach-experts-share-most-important-next-step-you-should-take-after-data-breach-2014-2015" target="_blank" rel="noreferrer noopener">&ldquo;Data breach experts share the most important next step you should take after a data breach in 2019 &amp; beyond,&rdquo;</a>&nbsp;Digital Guardian, Aug. 11, 2020 11,12 <a href="https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/gd_pb_201810/" target="_blank" rel="noreferrer noopener">&ldquo;What you need to know about mandatory reporting of breaches of security safeguards,&rdquo;</a>&nbsp;Office of the Privacy Commissioner of Canada,&nbsp; Oct. 2018&nbsp; 13 <a href="https://www.smartdatacollective.com/4-easy-steps-conduct-security-audit-company/" target="_blank" rel="noreferrer noopener">&ldquo;4 easy steps how to conduct IT security audit of your own company,&rdquo;</a>&nbsp;SmartDataCollective, May 22, 2017&nbsp; 14 <a href="https://www.computerworld.com/article/3535590/avoid-security-breaches-how-to-protect-your-data.html" target="_blank" rel="noreferrer noopener">&ldquo;Avoid security breaches: How to protect your data,&rdquo;</a>&nbsp;Computer World, April 1, 2020&nbsp;

5 steps to manage a data breach

In today&rsquo;s ever evolving cyber age, data has become one of the most valuable assets of every business. Cyber protection is essential for your business, but it&rsquo;s equally critical to reduce your cyber exposures and build resiliency to prevent, or at least minimize, a cyber-attack in the first place.
What are the implications for your business if it were to suffer a data breach? Could your business recover?
Here are four key take-aways that any business can use to help them manage their cyber exposures.
<h3>1. Inform and educate</h3>
Education is key, and it&rsquo;s not only an IT responsibility and risk. It&rsquo;s everyone&rsquo;s responsibility.
Employee cyber security training is essential. In a corporate setting, human error is the weakest link in the security chain. Employers need to educate employees of impending risks and vulnerabilities and how to avoid them.
Cyber security should be a pillar of the corporate culture and this can be achieved in a number of ways:
<ul>
<li>Conduct regular sessions with your employees where you can discuss real world examples of security incidents and make it relevant to what people do</li>
<li>Incorporate cyber security best practices into the discussion and protocols when you&rsquo;re onboarding new employees</li>
<li>Train individuals on the actions they should take if they suspect a security threat, and don&rsquo;t forget to periodically test individuals to affirm that they truly understand what they should be looking out for &nbsp;&nbsp;&nbsp;</li>
</ul>
<h3>2. Mitigate cyber risks</h3>
Here are some mitigation strategies that businesses can use to protect their data:
<ul>
<li>Encrypt data: Encryption can be an effective cyber-crime prevention strategy, rendering data difficult to access if it falls into the wrong hands.</li>
<li>Back up data and store it separately: Backing up data and storing it separately strengthens your resiliency in the face of ransomware attacks, where attackers lock companies out of their own systems.</li>
<li>Use strong passwords: Using unique and complex passwords, changing them often and discourage password sharing</li>
<li>Restrict network administration rights: Employees can&rsquo;t mistakenly give away information they don&rsquo;t have access to. Use robust anti-malware and firewall software. While effective Restrict network administration rights: Employees can&rsquo;t mistakenly give away information they don&rsquo;t have access to. Use robust anti-malware and firewall software. While effective anti-malware tools catch and isolate software viruses when they hit, preventing these viruses from entering your database in the first place is most important.</li>
</ul>
<h3>3. Make a plan</h3>
If you collect or store data in the course of commercial activity, you as a custodian are responsible.
On November 1, 2018, important changes to the Personal Information Protection and Electronic Documents Act (PIPEDA) came into force . Both large and small businesses that are subject to PIPEDA must report material personal information breaches to the Privacy Commissioner and the individuals concerned, and keep records of all breaches. &ldquo;If you collect or store data in the course of commercial activity, you as a custodian are responsible&rdquo; said Julie.
Therefore, it&rsquo;s important for businesses to develop incident response plans and put procedures in place to minimize, contain, and recover from a data breach. Incident response plans act as a roadmap to be followed by response teams when a data breach is discovered. Effective plans require the organization to understand the quantity of sensitive data that&rsquo;s being stored, the type of data (personal data, customer data, intellectual property etc.), how it&rsquo;s being secured, and who has access to the information.
In the face of a breach, there are two things your company can do to inform how best to respond:
<ul>
<li>Identify a data forensics team: Independent forensic investigators can help determine the source and scope of the breach.</li>
<li>Consult legal counsel: They can advise on your responsibilities under applicable provincial and federal privacy laws.</li>
</ul>
<h3>4. Lean on experts</h3>
Some insurance policies include breach preparation and crisis management services and resources. These services can include:
<ul>
<li>Counseling</li>
<li>Crisis management</li>
<li>Notification assistance</li>
<li>Breach victim remediation planning</li>
<li>Media relations consulting</li>
<li>Regulatory communication</li>
<li>Personalized access to a breach preparedness website</li>
</ul>
Having the right type of expert to help you navigate the complexities and nuances of data security can make all the difference when you&rsquo;re preparing for or facing a breach.
To be resilient is to be informed, proactive, and supported. Talk to your insurance broker to ensure you&rsquo;re getting access to the resources and expertise you need to be just that.